WIP: An Engaging Undergraduate Intro to Model Checking in Software Engineering Using TLA+

Konstantin Läufer,Gunda Mertin,George K. Thiruvathukal

2024-08-19

Abstract:Background: In this paper, we present our initial efforts to integrate formal methods, with a focus on model-checking specifications written in Temporal Logic of Actions (TLA+), into computer science education, targeting undergraduate juniors/seniors and graduate students. Formal methods can play a key role in ensuring correct behavior of safety-critical systems, yet remain underutilized in educational and industry contexts. Aims: We aim to (1) qualitatively assess the state of formal methods in computer science programs, (2) construct level-appropriate examples that could be included midway into one's undergraduate studies, (3) demonstrate how to address successive "failures" through progressively stringent safety and liveness requirements, and (4) establish an ongoing framework for assessing interest and relevance among students. Methods: After starting with a refresher on mathematical logic, students specify the rules of simple puzzles in TLA+ and use its included model checker (known as TLC) to find a solution. We gradually escalate to more complex, dynamic, event-driven systems, such as the control logic of a microwave oven, where students will study safety and liveness requirements. We subsequently discuss explicit concurrency, along with thread safety and deadlock avoidance, by modeling bounded counters and buffers. Results: Our initial findings suggest that through careful curricular design and choice of examples and tools, it is possible to inspire and cultivate a new generation of software engineers proficient in formal methods. Conclusions: Our initial efforts suggest that 84% of our students had a positive experience in our formal methods course. Future plans include a longitudinal analysis within our own institution and proposals to partner with other institutions to explore the effectiveness of our open-source and open-access modules.

Software Engineering

What problem does this paper attempt to address?

The main problem that this paper attempts to solve is to better integrate formal methods, especially model checking using TLA+, into computer science education. Specifically, the author hopes to address the current deficiencies in education through the following points:

1. **Evaluate the Current Situation**: Qualitatively assess the current situation of formal methods in computer science courses.
2. **Construct Appropriate Examples**: Create examples of formal methods suitable for intermediate - level undergraduate study.
3. **Handle "Failure" Situations**: Demonstrate how to deal with "failure" situations in the system through gradually strict safety deployment and liveness requirements.
4. **Establish an Evaluation Framework**: Establish a continuous framework to evaluate students' interest in and relevance of formal methods.

### Detailed Explanation

#### Background and Problem
Many critical security systems and services rely on correct and reliable behavior, and formal methods play a crucial role in ensuring the correctness and security of systems. However, the application of formal methods in education and industry is still insufficient. Therefore, this paper aims to explore how to improve computer science education by introducing model checking (especially using TLA+) so that students can better understand and apply formal methods.

#### Specific Objectives
1. **Evaluate the Current Situation**:
- Qualitatively analyze the teaching status of formal methods in computer science courses, including the course level, the tools and techniques covered, and the time of the last teaching.

2. **Construct Appropriate Examples**:
- Create examples of formal methods suitable for intermediate - level undergraduate study, such as microwave oven control logic, etc., to help students understand safety and liveness requirements.

3. **Handle "Failure" Situations**:
- Demonstrate how to handle "failure" situations in model checking by gradually introducing more stringent safety deployment and liveness requirements. For example, in the microwave oven example, ensure that no radiation is generated when the door is open and that it will eventually close automatically to prevent overheating.

4. **Establish an Evaluation Framework**:
- Establish a continuous framework to evaluate students' interest in and relevance of formal methods to ensure the effectiveness of teaching methods.

### Conclusion
Through carefully designed course content and the selection of appropriate examples and tools, the author believes that a new generation of software engineers proficient in formal methods can be inspired and cultivated. Preliminary results show that 84% of students had a positive experience in the formal methods course. Future research plans include conducting longitudinal analysis within the institution and collaborating with other institutions to explore the effectiveness of open - source and open - access modules.

### Formulas Involved
- **Initial State Definition**:
\[
Init \triangleq \begin{aligned}
&\text{door} \in \{\text{OPEN}, \text{CLOSED}\} \\
&\wedge \text{radiation} = \text{OFF} \\
&\wedge \text{timeRemaining} = 0
\end{aligned}
\]

- **Tick Action Definition**:
\[
Tick \triangleq \begin{aligned}
&\text{radiation} = \text{ON} \\
&\wedge \text{timeRemaining}' = \text{timeRemaining} - 1 \\
&\wedge \text{timeRemaining}' \geq 0 \\
&\wedge (\text{IF timeRemaining}' = 0 \text{ THEN radiation}' = \text{OFF ELSE UNCHANGED} \langle \text{radiation} \rangle) \\
&\wedge \text{UNCHANGED} \langle \text{door} \rangle
\end{aligned}
\]

- **Safety Invariant**:
\[